We have, for reasons, a massive error file that has many different message formats in it. Im just looking to initially get the line into the server, then I should be able to split up the message field after. My config looks like this: filter { if [type] == "errorfile" { grok { match =>…

Duplicate entries after grok

Topic		Replies	Views
Remove part of message string Logstash	7	19447	December 21, 2016
Can't remove_field - help please Logstash	9	3455	July 6, 2017
[SOLVED] Drop filter issue Logstash	5	870	July 6, 2017
Dropping / Mutating first part of log event Logstash	6	1035	July 6, 2017
Remove message on filter before inserting in ES Logstash	4	6231	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Duplicate entries after grok

Related topics